🔍 Read the full analysis: Is AI Changing Vulnerability Research? A Look At CVE Data on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
CVE records rose sharply in 2026, with 13,934 published from Oct. 1 through Oct. 25, according to an analysis of NVD and CVE.org data. The records do not establish how much AI contributed to discovery, while Anthropic says 516 of 6,157 vulnerabilities it reported to maintainers were patched to its knowledge.
New CVE records rose sharply in 2026, with 13,934 published from Oct. 1 through Oct. 25, more than three times the 4,389 recorded in all of October 2025, according to an analysis of NVD and CVE.org data published Oct. 26. The figures show a surge in disclosed vulnerabilities, but do not establish how much artificial intelligence contributed to finding them or whether the reported flaws are being fixed quickly.
The analysis counted records by publication date using the U.S. National Vulnerability Database’s CVE API and cross-checked October entries against CVE.org. It reported 88,772 CVEs so far in 2026, 78% more than the 50,000 or so recorded in all of 2025, based on the figures provided. The October total is for the first 25 days, not a completed month.
The author’s monthly comparison shows the daily publication rate rising from 267 in June to 320 in July, 410 in August and 502 in September. For Oct. 1-25, the reported daily average was 557. The analysis says the rate of growth eased in October: monthly increases were 20% from June to July, 28% from July to August and 22% from August to September, compared with about 11% in October so far. An estimate that October could end near 17,000 records is a projection, not a final count.
The increase was concentrated among some large vendors and record-assigning organizations. Microsoft’s October count rose to 1,455 records from 180 in October 2025; Oracle’s rose to 1,078 from 78, and GitHub’s to 1,159 from 276. The analysis attributes Microsoft’s total in part to an October Patch Tuesday that SecurityWeek reported fixed 1,413 CVEs. Oracle’s records were concentrated largely on Oct. 20. These counts describe published records, not necessarily distinct new discoveries made during October.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
The Patch Gap Behind the Surge
The rise matters because disclosure is only one step in reducing security risk. A vulnerability record can help vendors, security teams and users identify a flaw, but protection depends on whether a fix is available, deployed and effective. The analysis cites Anthropic’s disclosure dashboard, which said that of 6,157 vulnerabilities reported to maintainers, 516 had been patched to the company’s knowledge. That is roughly one in twelve, according to the reported figures.
That tally should be read with care: it is Anthropic’s account of its own reporting program, not a measure of the patch status of all CVEs. Still, it points to the operational workload created when more flaws are found. Maintainers must assess reports, develop fixes and coordinate releases; organizations then need to test and install updates. A growing flow of disclosures can widen the gap between identifying a vulnerability and removing the exposure.
The article also says CISA’s Known Exploited Vulnerabilities catalog grew, but not at the same pace as CVE publications. Its supplied material states that CISA added 245 entries in all of 2025, but does not provide the corresponding 2026 total or enough detail to compare exploitation rates. CVE volume alone cannot show how many flaws attackers are using, how severe they are, or how many systems remain exposed.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
Apple MacBook Air 15-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, and Liquid Retina Display
As an affiliate, we earn on qualifying purchases.
What CVE Records Can Show
A CVE is a publicly tracked vulnerability identifier, generally issued through a CVE Numbering Authority, often a vendor or another authorized organization. The source analysis describes CVE publication as part of coordinated disclosure, commonly after a fix or a disclosure deadline. Criminals do not typically file CVE records for flaws they find, so the records largely reflect a defender-side disclosure process. That does not mean every listed flaw was first discovered by a vendor or researcher named in its record.
The analysis found that 6,346 of 13,934 October records, or 46%, named a finder. It counted 200 records, 1.4% of the total, that explicitly credited an AI lab or AI security firm as a finder, reporter or tool. The author describes this as a floor rather than a full estimate because records often omit attribution. Microsoft, Oracle, the Linux kernel, Chrome and GitHub together accounted for more than 5,000 records without naming a finder, according to the analysis.
AI companies have separately reported vulnerability research. Anthropic’s dashboard, as of Oct. 2, listed 29,439 candidate vulnerabilities found by Claude models; the company said external firms reviewed 6,123 and confirmed 92.7% as real. It also reported 219 CVE records and 365 GitHub advisories associated with the findings. OpenAI’s Patch the Planet program with Trail of Bits reported “hundreds of security issues” across 19 open-source projects, with each reviewed by people. These company-reported figures use different measures and cannot be directly equated with total CVE counts.
“That is a floor, not an estimate.”
— Thorsten Meyer, describing the October CVE records
AI Attribution Remains Incomplete
The public records do not establish how much of the 2026 increase was caused by AI-assisted research. More than half of October’s records did not name a finder, while the share explicitly crediting an AI lab or security firm was 1.4%. Those limits make it difficult to distinguish AI-assisted discoveries from work by researchers using other methods.
The figures also need careful interpretation. The source says 13,934 records were published from Oct. 1-25, while a later cross-check describes 13,766 October records plus 202 records later rejected. These totals appear to use different status or counting treatments, but the supplied material does not fully reconcile them. The NVD API query included all statuses; the CVE.org check counted records and later-rejected entries separately. The article’s data was retrieved Oct. 26, so later corrections or additions may change the totals.
It is also unclear how many published flaws are exploitable, actively exploited, or present in software still in use. The supplied source begins a comparison with CISA’s exploited-vulnerability catalog but does not include the 2026 figures needed to quantify that trend. Claims about attackers using low-cost AI agents are attributed in the source to NorForge and Reuters; the material here does not provide detailed supporting data to assess the scale of that activity.
Watch for Fixes and Updated Counts
The immediate next step is to track whether maintainers publish fixes for reported vulnerabilities and whether software operators apply them. Updated CVE records, vendor advisories and CISA’s Known Exploited Vulnerabilities catalog can help show how disclosure, remediation and known exploitation develop over time, though each measures a different part of the process.
October’s final publication total will provide a fuller comparison with previous months, and subsequent record updates may alter the count. Better finder attribution would also help researchers assess AI’s contribution, but the current records are too incomplete to support a precise estimate. Until more consistent evidence is available, the clearest conclusion is that CVE publication has accelerated while the role of AI and the resulting patch status remain only partly visible.
Key Questions
How many CVE records were published in October 2026?
The analysis counted 13,934 from Oct. 1 through Oct. 25. It also gives a cross-check of 13,766 October records plus 202 later rejected, reflecting a difference in counting or status treatment that the source does not fully reconcile.
Does the CVE increase prove AI is finding more vulnerabilities?
No. The records show a rise in published vulnerabilities, but 54% did not name a finder and only 1.4% explicitly credited an AI lab or AI security firm. The available attribution is too incomplete to measure AI’s overall contribution.
What does the Anthropic patch figure mean?
Anthropic said that, to its knowledge, 516 of 6,157 vulnerabilities reported to maintainers had been patched. This is a company-reported figure for its own disclosures, not a patch rate for all CVEs.
Are more published CVEs evidence of more attacks?
Not by themselves. CVE publication measures disclosed vulnerability records, not confirmed exploitation. The supplied analysis says CISA’s exploited-vulnerability catalog grew more slowly, but does not provide enough 2026 data to quantify the comparison.
Source: ThorstenMeyerAI.com
